GreenFi Cloudflare
← Back to overview
Expanded Architecture

The full picture under the WAF conversation.

WAF alone catches signatures. What modern fintech actually faces is account takeover, API abuse, and third-party script compromise — and the bundle that catches all of those is one contract, one console, one log. This page walks the architecture surface by surface, then closes with a 90-day proof plan.

The four GreenFi surfaces and what's running on each

Public DNS + HTTP recon on each subdomain. This grounds the conversation in fact, not generality — every primitive recommended below maps to a specific surface that's already live.

www.greenfi.com
Next.js on AWS CloudFront (via: 1.1 ...cloudfront.net, x-amz-cf-pop: HIO52-P5) — the marketing + onboarding surface
api.greenfi.com
Same AWS ELB pool as www — the money-moving API surface (transfers, deposits, account ops)
login.greenfi.com
Okta tenant via aspiration.customdomains.okta.com — the identity surface where ATO attempts land
my.greenfi.com
Customer dashboard — the authenticated session surface where session hijack and scraping matter
DNS authority
AWS Route 53 (ns-*.awsdns-*.org/com/net/co.uk) — same NS set across all subdomains
CSP posture
default-src * data: blob: 'unsafe-inline' 'unsafe-eval' — opportunity to harden at the edge without code changes

Each surface, the threat model, and the Cloudflare primitive that covers it

WAF was the original conversation. The actual security posture every fintech eventually arrives at is one layer in front of every surface, doing five things at once. This is what that looks like.

GreenFi surface
Threat model
Cloudflare primitive
www.greenfi.com
OWASP Top 10, automated abuse on form submissions, third-party script tampering, L7 floods on onboarding peaks
WAFBot ManagementPage ShieldDDoS L7 Signature + behavioral + script-integrity monitoring on the marketing surface.
api.greenfi.com
Schema-violating requests, broken object-level authorization (BOLA), enumeration attacks, abuse of high-value endpoints (transfers, deposit lookups)
API ShieldSchema ValidationRate LimitingmTLS OpenAPI-driven validation at the edge before any request reaches the AWS origin.
login.greenfi.com
Credential stuffing, brute force on Okta, account takeover via leaked passwords (Verizon DBIR 2025: ATO is the dominant fraud vector for neobanks)
Bot ManagementTurnstileAccount Takeover Protection Stops the abuse before requests reach the identity provider — ATO defense in front of Okta, not after.
my.greenfi.com
Session-cookie hijack on authenticated traffic, scraping of customer dashboards, leaked-credential reuse, regulatory data egress
WAFBot ManagementPage ShieldDLP Continuous monitoring of authenticated session surfaces with regulatory-grade DLP signals.
Internal staff access
Engineers, support staff, and contractors accessing customer data through AWS console, internal dashboards, and Salesforce
Cloudflare OneAccessWARPBrowser Isolation Identity-bound, device-posture-aware access to every internal tool. No VPN, no shared credentials.
CloudFront edge
Current AWS edge handles caching but no security policy enforcement; security tooling sits inside the AWS account, billed separately
CDNCache Orange-cloud in front of CloudFront — origin stays put; security + observability move to a unified plane.

Account takeover is the dominant fraud vector for 2026 neobanks

Public reporting from Verizon's 2025 DBIR and Mastercard's fraud disclosures both flag credential stuffing and account takeover as the fastest-growing attack pattern against fintech. A WAF catches request signatures — but ATO doesn't have a request signature, it has a behavioral fingerprint.

The shape of ATO traffic

Credential stuffing looks like legitimate login traffic — same URL, same Content-Type, same JSON body, same user-agent. The only signal is how the traffic flows: high-volume from rotating IPs, low session persistence, and stuffer-toolkit fingerprints in TLS handshakes.

That's what Bot Management + the Cloudflare bot intelligence network actually catches — billions of requests per day across global fintech customers, all feeding the same model.

Why "WAF catches it" doesn't

Most modern WAFs (including AWS WAF) have rate-limiting rules that can throttle. But the attacker controls request volume per IP — using residential proxies, the per-IP rate looks legitimate. The detection has to happen in aggregate behavior, not per-request signatures.

This is the structural reason ATO defense lives upstream of Okta, not inside the WAF — and why bundling it with WAF means the same console, the same audit log, and the same contract.

Turnstile vs. CAPTCHA

For surfaces where you want a soft challenge (high-risk transfer initiation, password reset), Turnstile replaces traditional CAPTCHA with a passive PoW signal that's invisible to legitimate users. Lower friction, higher fraud-catch rate.

Free for unlimited use, deploys as a single script tag, integrates with the Okta workflow without code changes to the IdP itself.

Audit log requirements

FDIC, OCC, and state banking regulators expect a unified audit trail of authentication events. Today, that's stitched across Okta, AWS CloudWatch, and the WAF logs in three different formats.

Logpush writes every Cloudflare event to a customer-owned R2 or S3 bucket in a single schema. One source of truth for the regulatory conversation.

The bundle math vs. point-product stitching

The original WAF conversation framed Cloudflare against AWS WAF on a single-product basis. The conversation that's worth reopening is the bundle vs. multi-vendor stitching, where the comparison gets more interesting.

Today: multi-vendor stitching

AWS WAF for L7 filtering. A separate bot management vendor (PerimeterX, DataDome, or in-house). API security as a discrete tool (typically Salt Security, Noname, or Cequence). Page Shield equivalent (probably nothing — most fintechs don't have CSP-aware script monitoring). Each tool: a separate contract, separate console, separate log format.

Per-vendor pricing typically runs $80K–$150K/year for an enterprise neobank doing GreenFi's volume. Total stack cost: $400K–$600K/year for the equivalent feature set.

Cloudflare bundle

WAF + Bot Management + API Shield + Page Shield + Rate Limiting + Turnstile + Logpush — single contract, single console, single log format. Cloudflare One adds the internal-access piece.

Enterprise pricing varies by traffic, but the bundle typically lands at 40–60% of the multi-vendor stitching cost, before you factor in the engineering time saved from not stitching together three log formats and three IR runbooks.

The CloudFront question

You're paying AWS CloudFront today for the edge. Cloudflare can sit in front of CloudFront (orange-cloud) without origin changes — meaning the AWS spend stays exactly the same in the short term, and the value calculation is purely "marginal capability gain for marginal cost."

The longer-term question is whether to consolidate to one edge, but that's a quarter-3 conversation, not a "what do we do now" conversation.

The procurement angle

Most fintech security buyers say the same thing: "We don't have three Cyber FTEs and three vendor relationships budgeted." Bundle math wins not because it's cheaper per-feature but because it's one purchase order.

For a neobank with finite security headcount, the consolidation argument is usually the deciding factor — not the per-feature comparison.

What changes Monday, week by week

No rip-and-replace. AWS origin stays put. Every phase is reversible by toggling DNS or disabling a route. The goal is to land each value claim with a benchmark your team owns.

01
Weeks 1–3

Orange-cloud the four surfaces

Cloudflare in front of www, api, login, my. WAF managed rules + DDoS active. AWS origin and CloudFront unchanged. Baseline metrics captured before / after.

02
Weeks 4–8

ATO defense in front of Okta

Bot Management on login.greenfi.com. Turnstile on password reset + high-risk transfer flows. Measure credential-stuffing block rate vs. current Okta-only defenses.

03
Weeks 9–12

API Shield + Logpush

OpenAPI schema validation on api.greenfi.com. Logpush to a customer-owned R2 bucket for FDIC / OCC audit trail. Page Shield monitors third-party scripts on www.

Three factors converged since the original WAF conversation

The reason this is worth reopening — even if the original need feels like it's been quiet — is that the picture around it has changed in ways that affect the answer.

1. Credential stuffing volume against neobanks doubled in 2025. Verizon's 2025 DBIR shows fintech as one of the three most-targeted verticals, with a 113% YoY increase in ATO incidents reported. The WAF that was sufficient in 2024 isn't, structurally, sufficient now.

2. Bundle pricing has restructured. Cloudflare repriced its enterprise security plans in Q1 2026. The WAF + Bot Management + API Shield + Page Shield package now lands meaningfully below the per-product addition of competing point solutions, before factoring in operational savings.

3. Regulatory expectation has hardened. The OCC's Q1 2026 examination guidance explicitly flags credential-stuffing defense and unified audit logging as expected controls for neobanks. The answer to "show us your ATO defense story" used to be "we have a WAF" — that's no longer enough.